MsDtcProxy[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MsDtcProxy.exe
Size 486KB
Sample261102-qcewjsas5v
SHA256 ba8b0b9d2549ef68fea99dba9f69e8e9d735de35ae83fc36866b094289ad5a32
MD5 6a437336441e4e27bea7acc5de0aa888
SHA1 ccab6f36fa8a8fa715d381c30a49b737fc2de158
SHA512 ce034ee3e12105e1b8dcaac75de316b2d4d57367ea79dc76fe777627f55b842bf9745de7b642b344618639529857eb67eb2c3b12fd6f518bd4f7aedda489ad3f
SSDEEP 6144:yCX43NbEGO25mPcwz07hsn1oyDtADJY3tpOc8HpiwitHfG8MC0tsgcsrhKXLFFWZ:uOEA2yDtAF8LBwitHfG8N0tjXrPZ
TLSH
T1F9B44B16F2A500FAF577C57CC9939A06EB7278450730DADF07A0466A2F23BD49D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MsDtcProxy.exe

File Explorer

MsDtcProxy.exe

.exe 486KB

MsDtcProxy.exe

IMPHASH 9e3f929772caa6ec41697868e2527e68
SHA256 ba8b0b9d2549ef68fea99dba9f69e8e9d735de35ae83fc36866b094289ad5a32
MD5 6a437336441e4e27bea7acc5de0aa888
SHA1 ccab6f36fa8a8fa715d381c30a49b737fc2de158
SHA512 ce034ee3e12105e1b8dcaac75de316b2d4d57367ea79dc76fe777627f55b842bf9745de7b642b344618639529857eb67eb2c3b12fd6f518bd4f7aedda489ad3f
SSDEEP 6144:yCX43NbEGO25mPcwz07hsn1oyDtADJY3tpOc8HpiwitHfG8MC0tsgcsrhKXLFFWZ:uOEA2yDtAF8LBwitHfG8N0tjXrPZ
TLSH
T1F9B44B16F2A500FAF577C57CC9939A06EB7278450730DADF07A0466A2F23BD49D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

95984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

GetTokenInformation OpenServiceW StartServiceCtrlDispatcherW CheckTokenMembership FreeSid OpenProcessToken RegSetValueExW ControlService RegisterServiceCtrlHandlerW RegCreateKeyExW SetServiceStatus AllocateAndInitializeSid OpenSCManagerW CloseServiceHandle RegCloseKey CryptReleaseContext RegQueryValueExW DuplicateTokenEx CryptGetHashParam ChangeServiceConfigW CreateProcessAsUserW RegOpenKeyExW StartServiceW CryptDestroyHash CryptHashData CryptCreateHash RegEnumKeyExW GetNamedSecurityInfoW DeleteService SetNamedSecurityInfoW SetEntriesInAclW ChangeServiceConfig2W QueryServiceStatus CryptAcquireContextW CreateServiceW AdjustTokenPrivileges LookupPrivilegeValueW

shell32

SHGetFolderPathW CommandLineToArgvW ShellExecuteExW ShellExecuteW

kernel32

DeviceIoControl GetModuleFileNameW CreateMutexW CreateFileW ReleaseMutex GetSystemDirectoryW ProcessIdToSessionId Sleep GetLastError CloseHandle LocalFree ExitProcess GetCurrentProcessId FlushFileBuffers ReadFile SizeofResource FindFirstFileW WriteProcessMemory FindFirstVolumeW EnterCriticalSection FindNextFileW ExpandEnvironmentStringsW GetProcessId LeaveCriticalSection InitializeCriticalSection OutputDebugStringA GetEnvironmentVariableW SetEndOfFile GetTempPathW FindClose WaitForSingleObject GetFileAttributesW OpenProcess SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar GetExitCodeThread GetTickCount64 Process32NextW LockResource DeleteFileW Process32FirstW LoadLibraryW CreateThread LoadResource FindResourceW Module32FirstW GetLocalTime SetVolumeMountPointW GetProcAddress VirtualAllocEx WTSGetActiveConsoleSessionId GetFileSize FindVolumeClose CreateProcessW GetModuleHandleW FreeLibrary SetFirmwareEnvironmentVariableExW CopyFileW GetFirmwareEnvironmentVariableExW GetVolumePathNamesForVolumeNameW CreateRemoteThread Module32NextW GetSystemTime DeleteVolumeMountPointW VirtualFreeEx FindNextVolumeW GetDriveTypeW LoadLibraryExW GetExitCodeProcess GetFileType GetConsoleOutputCP GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx WriteFile GetCurrentProcess GetCommandLineW GetConsoleMode HeapSize HeapReAlloc WriteConsoleW SetFilePointer LCMapStringW VirtualProtect GetCurrentThreadId WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx DeleteCriticalSection ExitThread FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent TerminateProcess GetStdHandle IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoInitializeSecurity CoUninitialize

ncrypt

NCryptOpenKey NCryptOpenStorageProvider NCryptFinalizeKey NCryptSetProperty NCryptCreatePersistedKey NCryptFreeObject

crypt32

CertStrToNameW CertOpenStore CertFindCertificateInStore CertCloseStore CertAddCertificateContextToStore CryptSignMessage CertCreateSelfSignCertificate PFXImportCertStore

shlwapi

PathFileExistsW PathRemoveFileSpecW

ntdll

RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RtlCaptureContext RtlVirtualUnwind

Name

.text

Size

195KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

181KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

MsDtcProxy.exe

advapi32

shell32

kernel32

oleaut32

ole32

ncrypt

crypt32

shlwapi

ntdll

generic